Sequential Attack with Intensity Modulation on the Differential-Phase-Shift Quantum 

Key Distribution Protocol 
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In this paper, we discuss the security of the differential-phase-shift quantum key distribution 
(DPSQKD) protocol by introducing an improved version of the so-called sequential attack, which 
was originally discussed by Waks et al.pj. Our attack differs from the original form of the sequen- 
tial attack in that the attacker Eve modulates not only the phases but also the amplitude in the 
superposition of the single-photon states which she sends to the receiver. Concentrating especially 
on the "discretized gaussian" intensity modulation, we show that our attack is more effective than 
the individual attack, which had been the best attack up to present. As a result of this, the recent 
experiment with communication distance of 100km reported by Diamanti et al.0] turns out to be 
insecure. Moreover it can be shown that in a practical experimental setup which is commonly used 
today, the communication distance achievable by the DPSQKD protocol is less than 95km. 



I. INTRODUCTION 

The differential-phase-shift quantum key distribution 
(DPSQKD) protocol[| is a promising protocol for quan- 
tum key distribution (QKD) featuring the tolerance 
against photon number splitting attacks. However, its 
security has only been investigated so far against limited 
types of attacks; The most effective attack up to present 
had been a particular type of individual attacks investi- 
gated by Waks et al. Q, in which Eve acts on photons 
individually rather than on signals. Several long-distance 
experiments claiming security along its line have been 
reported (see, e.g.,[3| and references therein). Another 
important class of attacks is a variant of intercept-resend 
attacks called sequential attacks which was also discussed 
originally by Waks et al. @ and later improved by Curty 
et al.Q. However, they still remain less effective than 
the individual type for most probable applications. 

We will here present a further improvement on the se- 
quential attack in which the attacker Eve modulates not 
only the phases but also the amplitude in the superpo- 
sition of the single-photon states which she sends to the 
receiver. In this paper, with a slight abuse of terminology, 
we call such differentiations in the amplitude an inten- 
sity modulation and investigate its consequence. Concen- 
trating especially on the "discretized gaussian" intensity 
modulation, we show that our attack is more effective 
than the individual attack, which had been the best at- 
tack. As a result of this, the recent experiment with com- 
munication distance of 100km reported by Diamanti et 
al.[|[ turns out to be insecure. Moreover it can be shown 
that in a practical experimental setup which is commonly 
used today, the communication distance achievable by 
the DPSQKD protocol is less than 95km. 

In what follows, we shall consider a conservative defini- 
tion of security, i.e., we assume that Eve can control some 
flaws in Alice's and Bob's devices (e.g., the detection ef- 
ficiency and the dark count probability of the detectors) , 



together with the losses in the channel, and she exploits 
them to obtain maximal information about the shared 
key. 



II. DPSQKD PROTOCOL 

The DPSQKD protocol proceeds as follows 0, i]. 

1. Alice generates a random bit string x = (xq, • ■ ■ , 
xjy), Xi € {0,1} and sends to Bob the coherent 
light pulses with phase <pi ~ nxi + <f> and intensity 
a, where <fi, a € R, a > 0. That is, Alice generates 
the following |^) and sends to Bob: 

|*) = |ae #0 )®---<g>|ae^ N ). 

Intensity a is related to the average photon number 
fi per pulse as n = \a\ 2 . 

2. Using a Mach-Zehnder interferometer (FigfT]), Bob 
measures the phase difference Zi — Xi + of 
each adjacent pair of pulses [6]. The outcome of 
the measurement is recorded as the sifted key b = 
(bi, . . . , h), b a = x ta +x ia -i, where i lr . are the 
times when photons are detected. 

3. Communicating on an authenticated classical chan- 
nel, Alice and Bob perform key reconciliation and 
the generalized privacy amplification^, 5] to calcu- 
late the secret key. 

We denote by T the transmission of the communication 
channel including the loss in fiber and Bob's interferom- 
eter, and the quantum efficiency of Bob's detector. We 
also denote by d the dark count of Bob's detector. Then 
the signal and detection rate p c iick at Bob's side is given 
by 



Pclick 



Tfl + d. 



(1) 



Thus in the second step above, the average length I of 
the sifted key is I = Np c n c k- 
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FIG. 1: Basic experimental setup of a DPSQKD system. Here 
PM denotes a phase modulator, and BS a 50:50 beamsplit- 
ter. At represents the time difference between two consecu- 
tive pulses. Photon detectors DetO and Detl output the phase 
diffcrece Zi = and 1 respectively. 



III. SEQUENTIAL ATTACK WITH INTENSITY 
MODULATION 



3. Eve sends eN pulses which she kept intact in the 
first step, and sends them to Alice. 

In what follows, we assume that transmission T and 
Pciick/« are small enough (e.g., with the communication 
distance being sufficiently large) so that e can be ne- 
glected. 
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In this section, we first define our attack and then cal- 
culate several probabilities that are necessary for later 
analyses, i.e., the error rate which Bob detects as a re- 
sult of the attack and the success probability of Eve's 
attack. The necessary conditions for Eve to carry out 
the attack are also derived in terms of experimental pa- 
rameters, such as the average photon number n and the 
transmission T. 



FIG. 2: Graphical image of our sequential attack. (l)Alice 
emits coherent light pulses with an equal intensity, and Eve 
detects them. (2) When sequential detection events are found, 
Eve sends out single-photon state |$) of Eqn.©, which is a 
superposition of single-photon states having the same phases 
as Alice's original signal but with different amplitudes. 



A. Description of Attack 

The basic scheme of our sequential attack is the same 
as the previous versions given in Ref . Q . The only differ- 
ence is that the state \P which Eve sends is a superposi- 
tion of single-photon states with different amplitudes (see 
Fig|2J). The precise definition of our attack is as follows: 

1. Using unambiguous state discrimination (USD, see 
Ref. [2|) measurement, Eve measures the phase xt of 
all but small portion of the pulses that Alice sent 
and records the outcome. 

Here the small portion means a pulse sequence of 
length eN with e = (1 — r)p c ii c k/ra- The ratio r £ R, 
< r < 1 is a parameter to be specified later. 

2. For rpdickN sequential detection events of length k 
or larger, Eve does as follows: 

If the detected phases were, say, x a , . . . , x a +k-i, 
she generates state |<&) defined as 

a+k+M 

|$):= J2 (-1)^410), (2) 

j=es— M 

and sends it to Bob. Here parameter M £ N is a 
sufficiently larege number, and yi are set as yi = Xi 
for a < i < a + k — 1, and other S {0, l}'s are 
randomly chosen values. The creation operator a\ 
denotes a single photon pulse incident to Bob for 
time interval i. 



B. Probability of Sequential Detection 

The USD measurement performed in the first step suc- 
ceeds for each pulse with probability 

PuST>(n) = 1 - exp(-2n), 

where n = |ev| 2 is the average number of photon per 
pulse|2j. It can easily be shown that when Eve repeats 
it for a sufficiently long sequence of pulses, a sequential 
detection with length k or larger occurs with probability 

p scq (k, n) = (1 - Ptjsd(^)) {p\JSD{n)) k ■ (3) 

In other words, as a result of USD measurements on N 
pulses, Eve finds on average Np Beq (k,n) events of se- 
quential detections of at least length k. Hence rp c ii C k < 
Pscq(k, n) is necessary in order for Eve to carry out her 
attack. 



C. Error Rate Due to $ 

Every state |4>) sent by Eve in the second step will 
always yield one detection event in Bob's detector in ei- 
ther of time i. In other words, Bob's overall detection 
probability of |$) is strictly one. However, the detection 
can generally occur in a wrong detector causing the bit 
flip in the sifted key, or it may click in time i where Eve 
does not know the corresponding phase shift, in which 
case she fails to steal the sifted key bit. 
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To evaluate these effects we will below obtain, in terms 
of the amplitude Ai, the formulae for the error rate E{k) 
caused by each |$), and the probaility D(k) that Eve 
ends up reading the sifted key bit using |<fr). In what 
follows, we suppose that N is sufficiently large and Ai 
converges to zero fast enough for i — ► ±00, so that pa- 
rameter M introduced in the second step of our attack 
can be regarded as infinite . 

Suppose that Eve has succeeded in determining k sub- 
sequent phases x a , . . . , x a+ i;-i i n the first step and knows 
the corresponding phase differences z a +x, . . ., z a +fc-i- 
Then in the second step, state of Eqn.@ sent to 
Bob evolves inside his interferometer as 
00 

i $ > - 2 E K-irAi+i-ir-iA^diio) (4) 

i — — 00 
00 

+2 E [-(-i) w a + (-i) ,m - i a--i]4io), 

i— — 00 

where creation operators and d\ t denotes the single 
photons incident to the detectors outputting z% = and 
1 respectively. 

An error in Zi occurs when the spectrum d\, +li \Q) con- 
tained in Eqn.(|4]) is measured by Bob. Hence Bob detects 
error with probability 

00 

E ^ = l E K-ip+y-At- (-lf-i+y^A^l 2 . 

i— — 00 

By summing this over for Eve's random choices of yi for 
i < a and a + k < i, we have 

GS+fc— 1 

E(k) = - J2 \Ai-A^ (5) 

i— a+1 

1 / a 00 \ 

+1 E + E W+i^-ii 9 ]. 

\z— — 00 i—a+k/ 

On the other hand, Eve ends up knowing Alice and 
Bob's raw key bit when Bob detects either one of phase 
differences z a +i, ■ ■ -,z a +k-i, which occurs with probabil- 
ity 

et+fe— 1 

D(k) = - [lAtf + lA^] 2 ]. (6) 

i— a+1 

Note here that we are justified in including error events in 
D{k) because the corresponding sifted key bit will always 
match between Eve and Bob due to key reconciliations 
to be performed later, as long as the detected error rate 
is smaller than the threshold QBER. 

D. Effective Error Rate 

Hence in order for Eve to carry out the attack it is 
sufficient that there exist parameters 1 < k and < r < 1 



such that 

Tciick < P scq (k,n), (7) 
rE(k) < e oxp , (8) 

where e exp is the QBER in the absence of Bob. Inequality 
([7j) means that Eve has an enough number of sequential 
events, and Inequality ([8]) is to guarantee that the error 
rate is small enough so that the presence of Eve will not 
be noticed by Bob. And as a result of the attack, Eve 
steals rD(k)Np dick bits out of an sifted key of length 
^Pciick bits on average while the error rate measured by 
Bob is rE{k). 

Since key reconciliation and the generalized privacy 
amplification are used in the secret key generation of the 
DPSQKD [l|, LSI] , the key generation rate R is bounded 
from above as 

R < Pciick (I(A; B) - I(A; E)) 
= Pciick (1 - H 2 (e cxp ) - rD(k)) , 

where I(A; B) and I(A; E) are the mutual informa- 
tions between Alice and Bob, and between Alice and 
Eve, respectively. Clearly, I(A;B) equals 1 — H 2 {e c ^ v ) 
with H2(x) being the binary entropy function H%(x) :— 
— xlog 2 x — (1 — x) log 2 (l — x), and I(A; E) is given by 
rD(k) in our sequential attack. 

Thus if Eve is not interested in obtaining as many 
sifted key bits as possible, but rather she is only will- 
ing to invalidate the key distribution between Alice and 
Bob, the best strategy for her is to minimize the error 
rate rE{k) by suppressing the ratio r. That is, when In- 
equalities (0 and (JSJ) are satisfied for r = 1 and a certain 
value of k, the error rate rE(k) measured by Bob can be 
further reduced by taking r such that 

1 - H 2 (rE(k)) - rD(k) = 0. (9) 

In what follows, we will call such minimum value of rE{k) 
the effective error rate and denote it by E c s{k). 

IV. GAUSSIAN INTENSITY MODULATION 

In the original form of sequential attacks as introduced 
by Waks et al.[5|, the amplitude AiS were 

. _ j 1/vk for a<i<a + k — 1, 
1 \ otherwise, 

for which the error and detection rates were 

E(k) = l/2k, and D(k) = (k- l)/k. (10) 

In this section we demonstrate how these can be im- 
proved by selecting an appropriate wave form for Ai. 

One can generally seek for the best attack strategy, 
i.e., the best pattern of Ai with the smallest E(k) pos- 
sible for each value of k while maintaining the enough 



4 



ratio D{k) of bits accessible to Eve, as long as fcs are suf- 
ficiently small. Indeed it is not difficult at all to find out 
the best Aj, e.g., by doing numerical simulations, but in 
this paper, as the first trial, we will concentrate on the 
following (discretized) gaussian pattern: 



Ai = C exp 



(i-c) 



2 1 



4ct 2 



(11) 



The constant C appearing on the right hand side normal- 
izes |$) as ^2 n \A n \ 2 = 1, c denotes the time offset, and 
a is the standard deviation to be adjusted later. For the 
present we will set c at the center of Eve's detected sig- 
nals, i.e., when Eve has detected phases x a , ■ ■ ■ , x a+ k-i, 
we set c = a + (k — 1) /2. 



A. First-Order Approximation of E(k) and D(k) 

In order to have a rough idea as to how effective the 
gaussian intensity modulation in Eqn. lfTTj) is, we first in- 
vestigate it in the continuous limit of k,a — > oo, where 
E(k) and D(k) given in Eqn.([5]) and ^ can be explicitly 
calculated. In this limit C — ► (\/27rcr) -1 / 2 and we have 



|/"f|2 00 

i— — oo 



AiAi-i 

i— — oo i—a+k/ 



e 2<r^ 



IC' 2 



i—a+k 



■la 



5^2 



i/gr i 

^ 5^1 



5( 



1 - e 



-1/8<T' 



-l/8<x a 



/27r 



fe/2o 



1 



1-erf 



16a 2 ' ' — V2v / 2tr 
with erf(-) being the error function 



erf(x) := — -j= 



dt e 



Thus by choosing k — 4cr for example, we have E(k) ~ 
1/fc 2 + 0.0228, which is far smaller than Ean.([TrJ)). Simi- 
larly, the detection rate can be calculated as 



D(k) 



1 



/k/2a 
-fc/2ff 



2 / 2 = erf 



/ fc 



V2V2o 



B. Corrections Due to Discretization 

In reality, we must take into account the corrections 
due to dicretization. Adjusting values of it, we numeri- 
cally calculated for each value of k the smallest of error 



rate E(k) as shown in Table HI These values agree with 
the above first-order approximation within 10% for k > 8. 



k 


a 


E(k) 


D{k) 


E cS {k) 


4 


0.871 


0.105 


0.881 


0.0614 


5 


1.03 


0.0748 


0.930 


0.0495 


6 


1.18 


0.0562 


0.954 


0.0405 


7 


1.34 


0.0438 


0.968 


0.0335 


8 


1.49 


0.0353 


0.977 


0.0282 


9 


1.63 


0.0290 


0.982 


0.0239 


10 


1.78 


0.0243 


0.987 


0.0206 



TABLE I: The smallest error rate E{k) caused by |$) with 
the gaussian intensity modulation given in Eqn.{TT}. These 
minimums are obtained by adjusting the standard deviation 
a for each value of k. Here k denotes the length of Eve's 
sequential detection, D(k) the corresponding detection rate, 
and E c s(k) the effective error rate measured by Bob. 



V. COMPARISONS WITH EXPERIMENTS 

In this section, we discuss how our attack limits com- 
munication distances of the DPSQKD experiments. The 
main purpose here is to show that in many of practical ex- 
perimental setups, our attack works more effectively than 
the individual attack introduce by Waks et al.Q, hence 
reevaluating the security of several experiments reported 
up to now. 

We will first show that the experiment with a com- 
munication distance of 100km reported by Diamanti et 
al.Q is in fact insecure. Then we will also show that for 
a set of parameter values which are commonly used in 
today's QKD experiments and security analysis, e.g. in 
Ref.JI the DPSQKD cannot be secure for distances 
larger than 95km no matter how one adjusts the average 
photon number n. 



A. 100km Experiment by Diamanti et al. 

Diamanti et al.[3( performed a DPSQKD experiment 
with communication distance of 100km using the follow- 
ing set of parameters: 

- Average photon number n = 0.2, 

- Optical fiber of 100km = loss of 20dB, 

- Bob's Mach-Zehnder interferometer = loss of 2dB, 

- Efficiency of Bob's detector = 4 x 10~ 3 , 

- Bob's dark count probability d = 3.5 x 10~ 8 , 
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from which Bob's signal and dark count rate p c iick of 
Eqn.([T]) can be calculated as 

p c i ick = 5.12 x 1(T 6 

and the QBER they measured was 

e oxp = 3.4%. 

With these values, however, Eve can mount our sequen- 
tial attack with k = 9 and invalidate the secret key distri- 
bution. The conditions ([7]) and (jHJl for k — 9 are satisfied 
since p c iick < Pscq{k = 9, n = 0.2) = 3.08 x 10 -5 as can 
be found from Eqn.©, and E e g(9) = 2.39% < e cxp from 
Table H 



B. Limitations on the Communication Distance for 
a Practical Setup 



both monotonically increasing in n, and it holds that for 
n = 0.30, p scq (9,n = 0.30) > p c i ick (T,n = 0.30) and 
e oxp (T,n = 0.30) = 0.0302 > E cS {9) = 0.239. The effec- 
tiveness in other regions can be shown similarly. 



n 


Attack Type 


k 


~ 0.14 


individual 




0.14 ~ 0.19 


sequential 


6 


0.19 ~ 0.25 


sequential 


7 


0.25 ~ 0.30 


sequential 


8 


0.30 ~ 0.36 


sequential 


9 


0.36 ~ oo 


individual 





TABLE II: The list of suitable attack type for a 95km DP- 
SQKD experiment depending on parameter regions of the av- 
erage photon number n. The corresponding length k of a 
sequential detection event are also shown in the right column. 



Next we compare our result with a more general set of 
experimental parameters given in Refs.i and 

The signal and the dark count detection probability 
Pciick is as given in |T]) , where the transmission T typically 
takes the form 

T = ??int%etl0 _Q!nberi/ ' 10 . 

Here a n ber = 0.2dB/km is the fiber attenuation, L the 
fiber length, = 2dB the loss in Bob's Mach-Zchndcr 
interferometer [3j, and ?7dct = 0.1 the quantum efficiency 
of Bob's detectorQ. 

On the other hand, the error rate in the absence of Eve 
is given by 

_ MPciick + d/2 

^exp — , l^- / 

Pclick 

where fj, is the baseline error rate of the system due to 
imperfections in the state preparation, channel induced 
noise, and imperfect detection apparatus The typical 
values for fj, and the dark count d are fj, = 0.01 and d = 

io- 5 [|. 

Now let the communication distance L = 95km, or 
T = 10~ 31 (loss of 31dB). Then it can be shown that key 
distribution is shown to be impossible for any value of n 
as follows; For n < 0.14 and 0.36 < n, the gain formula 
i?i n d based on individual attack Q yields negative values: 

-Rind = -Pciick [(1 - 2n)log 2 P Co + H 2 (e cxp )} , 
p < 1 _ 2 _ (1 ~ 6e cxp ) 2 

± — ± Q cxp 2 

On the other hand, for n < 0.14 and 0.36 < n, In- 
equalities ||7J) and {SJ are satisfied for values of k given 
in Table [II] For example, Eve can mount the attack 
for k — 9 when 0.30 < n < 0.36 because in this 
parameter region, p seq (9,n) - p c iick and e exp (n,T) are 



VI. CONCLUSION 

In this paper, we presented an improved version of se- 
quential attacks with intensity modulation, which works 
more effectively than the individual attack. Using this 
attack, we have shown that the recent experiment with 
communication distance of 100km reported by Diamanti 
et al. [3j is in fact insecure. We also showed that in a prac- 
tical experimental setup which is commonly used today, 
the communication distance achievable by the DPSQKD 
protocol is less than 95km. 

There are several straightforward ways to improve our 
result. First, although we restricted ourselves in this pa- 
per to the discretized gaussian distribution of Eqn. (fTTjl , 
numerically optimizing Ai can yield a better form of state 
|$) with smaller error rate E{k) while maintaining detec- 
tion rate D(k), as mentioned at the beginning of Sec II VI 
Moreover, by letting |(f>) be a superposition of states with 
different photon numbers, we can increase the detection 
counts caused by each |$) to more than one. For in- 
stance, instead of the single-photon state |$) given in 
Eqn.((2), it is possible that a coherent state 

|$coh) = exp ^(-l)^Aaj + h.c.^J |0) 

leads to a more effective attack. Here h.c. stands for 
hermite conjugate. Note that the norm ^ \Ai\ 2 of A; 
corresponds to the average photon number contained in 
this state and need not be normalized. 
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